Anthropic’s Cyber Verification Program adds three access tiers

Anthropic combined two programs into three access levels

On October 6, Anthropic announced an expanded Cyber Verification Program, or CVP. The program combines its earlier CVP with Project Glasswing, which had provided selected organizations access to Claude Mythos for securing critical software. The new structure has Defense Access, Red Team Access, and Specialized Access. Anthropic says all three tiers can include its advanced models, including Opus 5.5, Sonnet 5.5, Mythos 5.1, and future models.

The announcement is about screened access to cyber capabilities with different safeguards. It does not turn every security task into an unrestricted model session. Anthropic’s separate help page explains who may apply, which work fits each tier, what controls are required, and how data is handled. Those details are necessary for understanding what the new program offers.

Access follows the work scope

Defense Access is for defensive tasks such as security operations, incident response, malware reverse engineering, and analyzing or validating vulnerabilities. Anthropic lists companies, nonprofits, universities, government bodies, critical-infrastructure operators, small security firms, open-source maintainers, and researchers with a record of reported vulnerabilities as potential applicants. The support page says independent researchers, maintainers, and bug-bounty hunters apply as individuals, and individual applicants can receive only Defense Access.

Some defensive coding work remains available in the general Claude service. Anthropic says all users can still ask for secure code review, threat modeling, patches for known issues, analysis of their own source code, and security-alert triage. Malware analysis or exploit validation may still trigger safeguards. This distinction keeps the program’s promise specific: CVP is for verified work that needs advanced capabilities beyond the ordinary model’s filters, not a blanket bypass for anything described as security research.

Red Team Access adds authorized penetration testing and red-team activity to the defensive work covered by Defense Access. Anthropic names in-house red teams, government red teams, and testing firms as examples of organizations that could qualify. The company says those teams may test only systems they are authorized to assess. An individual researcher cannot apply for this tier on their own.

Even with Red Team Access, Anthropic says real-time blocks remain for actions that could cause physical harm or mass disruption, including ransomware deployment, damage to physical systems, or testing high-risk safety systems. The company expects reviews to take weeks and says applicants who qualify will receive Defense Access while the Red Team request is reviewed. A tier label therefore does not establish permission to test a particular system; the organization still needs its own written scope and authorization.

Specialized Access is reserved for safety-critical infrastructure

Specialized Access has the fewest cyber blocks and is reserved for a limited set of verified organizations. Anthropic gives examples of safety-critical systems that could affect people’s lives or disrupt markets: flight operations, power grids, telecommunications, interbank transfers, and government administrative networks. The company says it reviews each organization in depth with the U.S. government. Existing Project Glasswing members transition into this tier without reapplying for their current models.

SecurityWeek’s October 7 coverage independently summarized the merger and the same three-tier structure. The outlet reports that the highest tier is limited to organizations permitted to test critical systems. That coverage reinforces the narrow eligibility claim. It does not establish how many applications will be approved or how often a team will encounter a block after approval; those depend on the organization, model, request, and current rules.

Applications are reviewed against the work and security setup

Anthropic’s help page says each organization should submit one application with details about the organization, the work, and the security controls required for the requested tier. Administrators can assign seats after approval. The company aims to reply within seven business days or request more information, although the Red Team review can take a few weeks. The help page also says Anthropic may narrow or withdraw a grant and that its Usage Policy continues to apply.

CVP access covers security work on an organization’s own code, products, and infrastructure. Using the access to test a client’s systems, or exposing the model through a client-facing service, needs a separate application and approval. For Defense Access, the help page sets a December 15, 2026 deadline for phishing-resistant multifactor authentication and ending API-key use; until then, some form of MFA is required and API keys expire every seven days. These are operational requirements, not optional best practices in the article.

The Help Center also says existing CVP members keep their current terms for models they already use and will be evaluated for access to the new models listed in the expansion. A previous approval therefore does not, by itself, show that access to every newly named model has been provisioned.

Data retention is part of the program’s monitoring design

Anthropic says CVP requires data retention so it can monitor for cyber misuse. The company describes Enterprise Frontier Safeguards as a future option that would let eligible organizations store data in cloud infrastructure they control. Until that becomes available, organizations with an existing zero-data-retention exemption for Claude Fable or Mythos may use CVP with zero retention. The standard route should therefore be evaluated with the organization’s data-handling rules before an application is filed.

The help page also describes platform-specific setup for Anthropic, Google Cloud, Microsoft Foundry, and AWS. Amazon Bedrock access is limited to customers with Enterprise Frontier Safeguards. A team that already has approval still needs to link the correct cloud account and provision the approved tier. The source page says some access changes can take time to reach an account. Verify the resulting access level in the portal before relying on it for a scheduled defensive task.

The tier test measures blocks in one company-run benchmark

Anthropic describes a CVP evaluation using ten CyScenarioBench challenges and five attempts per challenge in each access tier. In that test, it reports that all 50 tasks were blocked on the first prompt without CVP; 46 of 50 trials were blocked at some point in Defense Access; and no blocks occurred in Red Team Access, where 34 of 50 tasks completed. Anthropic says that completion rate matched its no-safeguard result for Specialized Access.

Those numbers show how Anthropic tuned the tiers in its own benchmark. They do not show that the model is safe in every real environment, or that it will never block a legitimate request. SecurityWeek reports the same tier structure, while the evaluation details come from Anthropic itself. A reader should treat the test as a description of the company’s safeguards under specific scenarios, then assess whether the organization’s authorization, security controls, and data policy fit the access being requested.